Abstract: A method implemented by a first edge node in an SD-WAN, the method comprises: establishing a secure management tunnel between an RR in the SD-WAN and the first edge node; advertising properties of the first edge node to the RR via the secure management tunnel for the RR to propagate the properties to a second edge node; establishing a first secure data channel with the second edge node; and exchanging first information with the second edge node. A method implemented by an RR in an SD-WAN, the method comprises: receiving first RTC NLRI from a first edge node in the SD-WAN; receiving second RTC NLRI from a second edge node in the SD-WAN; installing an outbound route filter based on the first RTC NLRI; and processing the second RTC NLRI based on the outbound route filter.

Abstract: A routing device including a memory and a processor. The memory stores instructions. The processor is configured to execute the instructions to receive a signed route origin authorization (ROA), which includes a blockchain hash, and a border gateway protocol (BGP) update message, which includes one or more routes. The processor is further configured to implement a Route Origin Validation (ROV) process using the blockchain hash in the signed ROA to determine whether the one or more routes in the BGP update message are valid; update a routing table to include the one or more routes from the BGP update message when the one or more routes are determined to be valid by the ROV process; and refrain from updating the routing table with the one or more routes from the BGP update message when the one or more routes are determined to be invalid by the ROV process.

Abstract: Techniques are presented to stitch existing virtual private networks (VPNs), such as MPLS based VPNs, with virtual private clouds (VPCs) in public cloud data centers. The stitching architecture can be realized by configuring a virtual routing application (VRA) in the VPCs and configuring virtual routing applications and a virtual routing application controller in the existing VPN. For VPCs in public clouds that do not have a VRA, traffic can be default routed to VPCs with a VRA.

Abstract: A method, an apparatus, and a system are provided for load balancing of a service chain. The method includes: receiving, by a flow classifier, a service chain selection and control policy sent by a policy and charging rules function (PCRF) unit; hashing, by the flow classifier according to a hash quantity, a service flow corresponding to a service chain identifier, to obtain multiple subflows, and adding the service chain identifier and hashing factors to packets of the subflows, where different subflows correspond to different hashing factors; and sending, by the flow classifier, the packets of the subflows after the service chain identifier and the hashing factors are added, to a forwarding device.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: A method for performing virtual private cloud (VPC) routing across multiple public cloud environments. In an embodiment, the method creates a first virtual routing agent (VRA) for a first VPC of a first public cloud. The method sends a registration request to a VRA controller, wherein the registration request comprises a data structure that includes communication parameters of the first VRA. The method receives the communication parameters of other VRAs for other VPCs located in other public cloud environments from the VRA controller. The method uses the communication parameters of the other VRAs for overlay routing of data packets from the first VPC of the first public cloud to other VPCs of other public clouds via the other VRAs of the other VPCs.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: Disclosed are a flow classifier, policy and charging rules function unit and controller. The flow classifier receives a service chain selection control policy sent by a policy and charging rules function unit. The service chain selection control policy includes a corresponding relation between an application type and an identifier of a service chain. The service chain is a path formed by a forwarding device and a value-added service device both of which a service flow with the application type needs to pass through. The flow classifier detects the service flow with the application type based on the service chain selection control policy and adds the identifier of the service chain to a message of the service flow. The flow classifier sends the message of the service flow with the added identifier of the service chain to a forwarding device directly connected to the flow classifier.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: A method performed by a controller configured to implement Border Gateway Protocol (BGP) in a communications system, comprising establishing a controller BGP (cBGP) peer session with a network element (NE), receiving a message for communication through the cBGP session from the NE, determining whether the message is permitted to be communicated through the cBGP session based on whether the message carries routing information; transmitting the message to the NE through the cBGP session when the message is permitted to be communicated through the cBGP session, and receiving a response message of the first type from the NE through the cBGP session.

Abstract: A Software Defined Wide Area Network (SD-WAN) edge node is disclosed. The SD-WAN edge node includes edge node SD-WAN ports coupled to untrusted underlay networks. The SD-WAN edge node transmits a first Border Gateway Protocol (BGP) update message advertising WAN (Wide Area Network) properties of the edge node SD-WAN ports to a local controller via an encrypted channel over the untrusted underlay network. The SD-WAN edge node receives a second BGP update message from the local controller, the second BGP update message advertising WAN properties of peer node SD-WAN ports of a peer node. The SD-WAN edge node establishes a security association with the peer node over the untrusted underlay networks based on the WAN properties of the edge node SD-WAN ports and the WAN properties of the peer node SD-WAN ports.

Abstract: A network device employs a transmitter configured to transmit a registration request to a software defined network (SDN) controller. The network device employs a receiver to receive a reply from the SDN controller. The reply indicates a plurality of provider edge (PE) devices coupled to a carrier network. The network device employs a processor to cause the transmitter and receiver to establish a plurality of asymmetric connections to a virtual private network (VPN) operating over a wide area network (WAN) via the PE devices.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: A network device employs a transmitter configured to transmit a registration request to a software defined network (SDN) controller. The network device employs a receiver to receive a reply from the SDN controller. The reply indicates a plurality of provider edge (PE) devices coupled to a carrier network. The network device employs a processor to cause the transmitter and receiver to establish a plurality of asymmetric connections to a virtual private network (VPN) operating over a wide area network (WAN) via the PE devices.

Abstract: Techniques are presented to stitch existing virtual private networks (VPNs), such as MPLS based VPNs, with virtual private clouds (VPCs) in public cloud data centers. The stitching architecture can be realized by configuring a virtual routing application (VRA) in the VPCs and configuring virtual routing applications and a virtual routing application controller in the existing VPN. For VPCs in public clouds that do not have a VRA, traffic can be default routed to VPCs with a VRA.

Abstract: A method for performing virtual private cloud (VPC) routing across multiple public cloud environments. In an embodiment, the method creates a first virtual routing agent (VRA) for a first VPC of a first public cloud. The method sends a registration request to a VRA controller, wherein the registration request comprises a data structure that includes communication parameters of the first VRA. The method receives the communication parameters of other VRAs for other VPCs located in other public cloud environments from the VRA controller. The method uses the communication parameters of the other VRAs for overlay routing of data packets from the first VPC of the first public cloud to other VPCs of other public clouds via the other VRAs of the other VPCs.

Abstract: A method, an apparatus, and a system are provided for load balancing of a service chain. The method includes: receiving, by a flow classifier, a service chain selection and control policy sent by a policy and charging rules function (PCRF) unit; hashing, by the flow classifier according to a hash quantity, a service flow corresponding to a service chain identifier, to obtain multiple subflows, and adding the service chain identifier and hashing factors to packets of the subflows, where different subflows correspond to different hashing factors; and sending, by the flow classifier, the packets of the subflows after the service chain identifier and the hashing factors are added, to a forwarding device.

Abstract: A method, an apparatus, and a system are provided for load balancing of a service chain. The method includes: receiving, by a flow classifier, a service chain selection and control policy sent by a policy and charging rules function PCRF unit; hashing, by the flow classifier according to a hash quantity, a service flow corresponding to a service chain identifier, to obtain multiple subflows, and adding the service chain identifier and hashing factors to packets of the subflows, where different subflows correspond to different hashing factors; and sending, by the flow classifier, the packets of the subflows after the service chain identifier and the hashing factors are added, to a forwarding device.

Abstract: A method implemented in a network engine comprising receiving, by a service function (SF) orchestrator in the network engine, a registration request message from a third-party SF manager requesting registration of a SF comprising one or more SF instances in a network, wherein the registration request message comprises vendor identification information identifying a vendor of the SF and SF identification information identifying the SF, receiving a capability information message from the third-party SF manager indicating vendor-specific capability information associated with the SF, receiving a service request message from a service client requesting a network service and one or more policies for the service, generating the network service by utilizing the one or more SF instances according to the one or more policies and the vendor-specific capability information, and sending the one or more policies to the one or more SF instances.

Abstract: Disclosed are a flow classifier, policy and charging rules function unit and controller. The flow classifier receives a service chain selection control policy sent by a policy and charging rules function unit. The service chain selection control policy includes a corresponding relation between an application type and an identifier of a service chain. The service chain is a path formed by a forwarding device and a value-added service device both of which a service flow with the application type needs to pass through. The flow classifier detects the service flow with the application type based on the service chain selection control policy and adds the identifier of the service chain to a message of the service flow. The flow classifier sends the message of the service flow with the added identifier of the service chain to a forwarding device directly connected to the flow classifier.